diff --git a/playbooks/maintenance.yaml b/playbooks/maintenance.yaml
index 9a7150b..e5838df 100644
--- a/playbooks/maintenance.yaml
+++ b/playbooks/maintenance.yaml
@@ -1,3 +1,16 @@
+- name: Ensure NGINX repo and install on nginx_hosts
+  hosts: nginx_hosts
+  tasks:
+    - name: make sure NGINX repos are setup
+      ansible.builtin.include_role:
+        name: nginx
+        tasks_from: main/repo_setup
+
+    - name: make sure NGINX is installed
+      ansible.builtin.include_role:
+        name: nginx
+        tasks_from: main/nginx_install
+
 - name: Make Sure System Package Are Up-To-Date
   hosts: all
   roles:
diff --git a/playbooks/roles/nginx/tasks/main/repo_setup.yaml b/playbooks/roles/nginx/tasks/main/repo_setup.yaml
index d563821..9edc156 100644
--- a/playbooks/roles/nginx/tasks/main/repo_setup.yaml
+++ b/playbooks/roles/nginx/tasks/main/repo_setup.yaml
@@ -1,9 +1,14 @@
+- name: gather package facts
+  ansible.builtin.package_facts:
+    manager: apt
+
 - name: make sure `gnupg` package is installed
   ansible.builtin.apt:
     name: gnupg
     state: present
     update_cache: true
   become: true
+  when: "'gnupg' not in ansible_facts.packages"
 
 - name: make sure NGINX signing key is added
   ansible.builtin.get_url: